Privacy Policy

1. Data Controller

For the purposes of the UK GDPR and EU GDPR, the data controller is:

2. Information We Collect

2.1 Information You Provide

We may collect:

• Account information (email address, user ID, authentication metadata)
• Subscription and billing status (payments are processed by third-party providers; we do not store card details)
• User-submitted content, including:
  • SQL queries
  • Database schemas
  • Sandbox data
  • AI prompts and questions

2.2 Information Collected Automatically

We may collect:

• IP address
• Device and browser information
• Operating system
• Usage data (pages viewed, actions taken, timestamps)
• Diagnostic and performance logs

3. How We Use Your Information

We use your data to:

• Provide, operate, and maintain the Service
• Authenticate users and manage accounts
• Execute SQL queries in sandbox environments
• Generate AI-powered explanations and guidance
• Enforce rate limits, usage caps, and fair-use policies
• Monitor security, performance, and abuse
• Improve and develop new features
• Comply with legal and regulatory obligations

4. AI Processing

SQLExplain.ai uses third-party AI service providers to generate explanations and responses.

• User prompts and relevant context may be processed solely to generate responses
• We do not train proprietary models on your data
• We do not sell user prompts or content
• Data shared with AI providers is minimised where possible

AI-generated outputs may be inaccurate and should not be relied upon without verification.

5. Sandbox Databases & User Content

• Sandbox databases are isolated per user
• Unsaved or inactive sandboxes may be automatically deleted
• Saved schemas are retained according to your subscription plan
• You must not upload sensitive, personal, or production data

6. Analytics & Monitoring

We use analytics and monitoring tools to:

• Understand feature usage
• Improve performance and reliability
• Detect abuse or suspicious activity

Data is processed in anonymised or aggregated form where possible.

7. Cookies

We use cookies and similar technologies to:

• Maintain sessions
• Remember user preferences
• Improve functionality and performance

You can manage cookies via your browser settings.

8. Data Sharing

We may share data with trusted third-party service providers where necessary, including:

• Authentication providers
• Cloud hosting and infrastructure services
• Payment processors
• AI service providers

We do not sell personal data.

9. Data Retention

We retain personal data only as long as necessary to:

• Provide the Service
• Meet legal, accounting, and compliance requirements
• Resolve disputes
• Enforce agreements

You may request deletion of your account and associated data at any time — see Section 14: Account Deletion below.

10. Your Rights

If you are located in the UK or EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

Requests can be made via privacy@sqlexplain.ai.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted connections and access controls. However, no system can be guaranteed to be completely secure.

12. Children's Privacy

SQLExplain.ai is not intended for children under the age of 13, and we do not knowingly collect data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page and reflected in the "Last updated" date.

14. Account Deletion

14.1 How to Delete Your Account

You can delete your account at any time from inside the app: open your profile menu (top-right avatar) and choose “Delete account”. You will be asked to confirm by typing your email address. Deletion can also be requested by emailing privacy@sqlexplain.ai.

14.2 Grace Period

Once you confirm deletion, your account is hidden from active use immediately and is scheduled for permanent deletion 30 days later. During this 30-day grace period:

• You can sign back in and cancel the deletion at any time from the in-app banner.
• Your data is preserved but inaccessible to other users.
• If you have an active Pro subscription, it is set to cancel at the end of the current billing period — you keep Pro access for the time you have already paid for.

14.3 What We Delete

After the grace period elapses, the following data is permanently deleted from our systems:

• Chat conversations, AI prompts and responses
• Sandbox sessions, saved sandboxes and any user-supplied data inside them
• User-submitted feedback
• API request and activity history (including IP addresses and user agents)
• Email address, display name and authentication identifier (Firebase UID)
• Your Firebase authentication record (you can no longer sign in with that identity)

14.4 What We Retain (and Why)

For tax, accounting and audit compliance under UK and EU law, we retain certain billing-related records for up to 7 years. After deletion these records no longer identify you — the link between you and the billing record is broken (your email and personal identifiers are removed). Aggregate, non-identifying usage counters may also be retained for service-quality monitoring.

Payment processing for subscriptions is handled by Stripe. Stripe retains transaction records under its own retention policy and applicable financial regulations; this is independent of our retention.

14.5 Confirmation

We will email you when your deletion is scheduled, and again when it has been completed. If you did not request a deletion and receive one of these emails, contact privacy@sqlexplain.ai immediately.

15. Contact